summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-07-14drm/i915/display: Fix NV12 ceiling division for bigjoiner caseVidya Srinivas
Commit 16df4cc63c58 ("drm/i915/display: Use ceiling division for NV12 UV surface offset calculation") computes the UV (chroma) surface start/size as ceiling(half of Y plane start/size) directly from the U16.16 fixed-point source rectangle: x = fp_16_16_to_int_ceil(fp_16_16_div2(src.x1)); For a single pipe the source coordinates are integers, so this is correct. (UV start = ceiling(half of Y plane start)). With bigjoiner + a plane scaler the picture changes. The pipe boundary is a fixed integer destination pixel, but the plane's position and the scaler ratio are arbitrary, so drm_rect_clip_scaled() maps the seam back to a *fractional* per-pipe source. For a 1280->2407 upscaled NV12 plane crossing the seam: master src: width = 1204 * 1280/2407 = 640.265899, x1 = 0 joiner src: width = 1203 * 1280/2407 = 639.734115, x1 = 640.265884 The luma path floors this to an integer (src.x1 >> 16 = 640), but the UV path takes ceiling(640.265884 / 2) = ceil(320.13) = 321. The Y plane then starts at column 640 while the UV plane starts at 321*2 = 642, pushing the chroma read one column past the 640-wide chroma surface on the joiner secondary: [CRTC:382:pipe C] PLANE ATS fault [CRTC:382:pipe C][PLANE:267:plane 1C] fault (CTL=0x81009400, ...) The spec "Y plane start" is the integer pixel the luma surface actually programs (640), not the pre-floor fixed-point value (640.27). Convert the Y plane start/size to integer first - matching skl_check_main_surface() - and then apply the ceiling. This is a no-op for the integer (non-joiner) case and yields the correct, in-bounds chroma offset for the fractional joiner seam: before fix after fix master 1B: x=0 w=321 x=0 w=320 -> [0, 320) slave 1C: x=321 w=320 x=320 w=320 -> [320, 640) The two halves now tile the 640-wide chroma plane exactly and the ATS fault is gone. Assisted-by: GitHub-Copilot:Claude-Opus-4.8 Fixes: 16df4cc63c58 ("drm/i915/display: Use ceiling division for NV12 UV surface offset calculation") Signed-off-by: Vidya Srinivas <vidya.srinivas@intel.com> Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com> Signed-off-by: Uma Shankar <uma.shankar@intel.com> Link: https://patch.msgid.link/20260618181837.687302-1-vidya.srinivas@intel.com
2026-07-14Merge tag 'rust-io-7.3-rc1' of ↵Danilo Krummrich
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core into drm-rust-next I/O type generalization and projection This series presents a major rework of I/O types, as a summary: - Make I/O regions typed. The existing untyped region still exists with a dynamically sized `Region` type. - Create I/O view types to represent subregion of a full I/O region mapped. A projection macro is added to allow safely create such subviews. - Split I/O traits, make I/O views play a central role, avoid duplicate monomorphization and less `unsafe` code. - Add a `SysMem` backend, and make `Coherent` implement `Io`. - Add copying methods (memcpy_{from,to}io and friends). This series generalize `Mmio` type from just an untyped region to typed representations (so `MmioRaw<T>` is `__iomem *T`). This allows us to remove the `IoKnownSize` trait; the information is sourced from just the pointer from the `KnownSize` trait instead. Building on top of that, `Mmio` and `ConfigSpace` have been converted to typed views of I/O regions rather than just a big chunk of untyped I/O memory. These changes made it possible to implement `Io` trait for `Coherent<T>`. Shared system memory, `SysMem` is also added to the series, given it similarity in implementation compared to `Coherent`. In fact, the series use `SysMem` to implement `Coherent`'s I/O methods. Built on these generalization, this series add `io_project!()`. `io_project!()` performs a safe way to project a bigger view to a small subviews, and some Nova code has been converted in this series to demonstrate cleanups possible with this addition. New `io_read!()`, `io_write!()` has been added that supersedes `dma_read!()`, `dma_write!()` macro. Although, they work for primitives only (to be exact, types that the backend is `IoCapable` of). One feature that was lost from the old `dma_read!()` and `dma_write!()` series was the ability to read/write a large structs. However, the semantics was unclear to begin with, as there was no guarantee about their atomicity even for structs that were small enough to fit in u32. Suggested-by: Danilo Krummrich <dakr@kernel.org> Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/Generic.20I.2FO.20backends/near/571198078 This is a stable tag for other trees to merge. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-13Merge patch series "rust: I/O type generalization and projection"Danilo Krummrich
Gary Guo <gary@garyguo.net> says: This series presents a major rework of I/O types, as a summary: - Make I/O regions typed. The existing untyped region still exists with a dynamically sized `Region` type. - Create I/O view types to represent subregion of a full I/O region mapped. A projection macro is added to allow safely create such subviews. - Split I/O traits, make I/O views play a central role, avoid duplicate monomorphization and less `unsafe` code. - Add a `SysMem` backend, and make `Coherent` implement `Io`. - Add copying methods (memcpy_{from,to}io and friends). This series generalize `Mmio` type from just an untyped region to typed representations (so `MmioRaw<T>` is `__iomem *T`). This allows us to remove the `IoKnownSize` trait; the information is sourced from just the pointer from the `KnownSize` trait instead. Building on top of that, `Mmio` and `ConfigSpace` have been converted to typed views of I/O regions rather than just a big chunk of untyped I/O memory. These changes made it possible to implement `Io` trait for `Coherent<T>`. Shared system memory, `SysMem` is also added to the series, given it similarity in implementation compared to `Coherent`. In fact, the series use `SysMem` to implement `Coherent`'s I/O methods. Built on these generalization, this series add `io_project!()`. `io_project!()` performs a safe way to project a bigger view to a small subviews, and some Nova code has been converted in this series to demonstrate cleanups possible with this addition. New `io_read!()`, `io_write!()` has been added that supersedes `dma_read!()`, `dma_write!()` macro. Although, they work for primitives only (to be exact, types that the backend is `IoCapable` of). One feature that was lost from the old `dma_read!()` and `dma_write!()` series was the ability to read/write a large structs. However, the semantics was unclear to begin with, as there was no guarantee about their atomicity even for structs that were small enough to fit in u32. Suggested-by: Danilo Krummrich <dakr@kernel.org> Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/Generic.20I.2FO.20backends/near/571198078 Link: https://patch.msgid.link/20260706-io_projection-v6-0-72cd5d055d54@garyguo.net Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-13Merge patch series "ForLt/CovariantForLt split, auxiliary closure API and ↵Danilo Krummrich
DevresLt" Danilo Krummrich <dakr@kernel.org> says: The ForLt trait currently guarantees covariance, which allows safe lifetime shortening via cast_ref(). However, some types (e.g. those containing Mutex<&'bound T>) are invariant over their lifetime parameter and cannot safely use cast_ref(). This series splits ForLt into two traits: - ForLt: base trait for all lifetime-parameterized types, providing only the Of<'a> GAT. - CovariantForLt: unsafe subtrait that guarantees covariance, providing a safe cast_ref() method. For invariant types, a closure-based API (registration_data_with()) is added to the auxiliary subsystem. The closure's HRTB prevents the caller from choosing a concrete lifetime, which would be unsound for invariant types. On top of that, this series adds DevresLt<F: ForLt>, a thin wrapper around Devres<F::Of<'static>> that shortens the stored 'static lifetime back to the caller's borrow scope. DevresLt provides both closure-based access (access_with/try_access_with for ForLt types) and direct reference access (access/try_access for CovariantForLt types). Also implement ForLt and CovariantForLt for Bar, IoMem and ExclusiveIoMem, and update their into_devres() methods to return DevresLt. Provide convenience type aliases DevresBar, DevresIoMem and DevresExclusiveIoMem. Link: https://patch.msgid.link/20260626183630.2585057-1-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-13drm/xe/multi_queue: preempt primary on queue group suspendNiranjana Vishwanathapura
In a multi-queue group only the group's primary queue interfaces with GuC for scheduling; suspend/resume of secondary queues is handled internally and is not forwarded to GuC. As a result, suspending a secondary queue alone (e.g. on its preempt fence signalling) does not disable the primary's GuC context, so in-flight GPU work of the group is not actually preempted. Make a secondary queue suspend/resume like any other queue, driven by its own xe_guc_exec_queue.suspend_count, and additionally forward the suspend/resume to the primary so the GPU is actually preempted. The forward is gated on the secondary's own 0->1 / 1->0 suspend_count transition, so each group member contributes exactly one suspend reference to the primary: the primary keeps its GuC context disabled until every member that suspended it has resumed, including across the resume-all-queues-each-rebind-cycle behavior. group->suspend_lock makes the secondary transition and the primary forward atomic, and a member leaving while still suspended (queue teardown) drops its reference on the primary. v2: Add comment about suspend_wait() in drop_suspend() v3: Do not suspend a secondary if primary is killed, wait for primay suspend to complete before drop_suspend() Assisted-by: Github-Copilot:Claude-opus-4.8 Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260713202317.2187787-14-niranjana.vishwanathapura@intel.com
2026-07-13drm/xe/guc: Add suspend refcount to exec queue opsThomas Hellström
With the lr.suspended flag a consumer already pairs its own suspend() and resume() correctly, and no current path issues overlapping suspends on the same queue. Add a reference count to the exec queue suspend operations, as a small self-contained building block for callers that can genuinely overlap. A queue stays suspended as long as any caller holds a suspend and only resumes once the last caller releases it, so each caller pairs its own suspend/resume without needing to know about the others. This is what the upcoming multi-queue support needs, where queues in a group share a primary and may be suspended concurrently. Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Co-authored-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260713202317.2187787-13-niranjana.vishwanathapura@intel.com
2026-07-13drm/xe/hw_engine_group: propagate suspend failures during mode switchNiranjana Vishwanathapura
The hw engine group fault-mode switch suspends all faulting LR queues but ignored the suspend()/suspend_wait() return value. A suspend() can fail (e.g. the queue is killed/banned/wedged), leaving the queue un-suspended, so silently continuing could later resume a queue that was never suspended. Propagate the failure instead: in xe_hw_engine_group_add_exec_queue() bail out if suspend() fails, and in xe_hw_engine_group_suspend_faulting_lr_jobs() undo the partial suspend via a new err_resume path that resumes the sibling queues already suspended in this call. Record per-queue success with lr.suspended so only queues that were actually suspended are waited on and resumed, and skip the cleanup resume() when suspend_wait() failed or the queue was reset/killed/banned/wedged (its suspend may not have completed, so resuming would trip the !suspend_pending assert in the resume path; teardown resolves its state instead). Gate the group resume worker (hw_engine_group_resume_lr_jobs_func()) on lr.suspended for the same reason, so it only resumes queues that were actually suspended. v2: Don't let a dying queue block the switch (Matt Brost) Assisted-by: Github-Copilot:Claude-opus-4.8 Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260713202317.2187787-12-niranjana.vishwanathapura@intel.com
2026-07-13drm/xe/guc: add uninterruptible suspend wait for cross-process cleanupNiranjana Vishwanathapura
Add a suspend_wait_blocking() exec queue op: an uninterruptible variant of suspend_wait() for callers that must complete a suspend on behalf of a queue that may belong to a different process than the calling task (e.g. cleanup/undo paths). An interruptible suspend_wait() returns -ERESTARTSYS when the calling task is signalled, which would leave the other process's queue suspended forever - a cross-process DoS. The blocking variant waits uninterruptibly and, on a genuine GuC timeout, bans and tears down the queue like suspend_wait() (shared via guc_exec_queue_suspend_timeout_ban()). It deliberately does not handle VF recovery since a blocking caller cannot retry. Assisted-by: Github-Copilot:Claude-opus-4.8 Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260713202317.2187787-11-niranjana.vishwanathapura@intel.com
2026-07-13drm/xe/guc: ban exec queue on suspend timeoutNiranjana Vishwanathapura
Harden guc_exec_queue_suspend_wait(): - In multi-queue mode the primary owns the group's GuC scheduling context, so wait on the primary's suspend to complete. - On timeout, ban the queue and trigger cleanup rather than leaving it suspended forever. Clearing suspend_pending via __suspend_fence_signal() lets a subsequent resume() proceed without tripping the !suspend_pending assert. A timeout on the primary wedges the whole group, so ban and tear down the entire group in the multi-queue case. The ban/cleanup is factored into guc_exec_queue_suspend_timeout_ban(). Add a note that on a signal (-ERESTARTSYS) the queue is not banned and the suspend is not confirmed complete, so callers must not resume() without re-confirming. Assisted-by: Github-Copilot:Claude-opus-4.8 Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260713202317.2187787-10-niranjana.vishwanathapura@intel.com
2026-07-13drm/xe: only resume exec queues that were actually suspendedNiranjana Vishwanathapura
A consumer-issued suspend() can fail (e.g. the queue is killed, banned or wedged), leaving the queue un-suspended. The consumer must then not issue the matching resume(): resuming a queue that was never suspended is incorrect. Add an lr.suspended flag to struct xe_exec_queue that records whether a consumer suspend() succeeded and a matching resume() is still owed. Set it on a successful suspend() in the preempt-fence path, clear it on resume(), and only resume queues that have it set. In resume_and_reinstall_preempt_fences() also skip queues that have since been reset/killed/banned/wedged: such a queue's suspend may not have completed (suspend_pending can still be set, e.g. a preempt fence signalled with -ENOENT without waiting), so resuming it would trip the !suspend_pending assert in the backend. Leave it marked suspended and let teardown resolve its state. A queue is only ever suspended by a single consumer at a time (preempt-fence mode and hw engine group fault mode are mutually exclusive), so a single flag is sufficient. Assisted-by: Github-Copilot:Claude-opus-4.8 Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260713202317.2187787-9-niranjana.vishwanathapura@intel.com
2026-07-13drm/i915/gt: use correct selftest config symbolPengpeng Hou
intel_engine_user.c checks CONFIG_DRM_I915_SELFTESTS before running the engine UABI isolation check. Kconfig defines DRM_I915_SELFTEST, without the trailing "S", and the rest of i915 uses CONFIG_DRM_I915_SELFTEST. Because CONFIG_DRM_I915_SELFTESTS is not backed by any Kconfig symbol, the IS_ENABLED() test is always false. Use the existing selftest symbol so the debug/selftest guarded path can be reached when selftests are enabled. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the Kconfig definition and the inconsistent guard in intel_engine_user.c. Fixes: 750e76b4f9f6 ("drm/i915/gt: Move the [class][inst] lookup for engines onto the GT") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260705080225.436-1-pengpeng@iscas.ac.cn (cherry picked from commit 14a2012a490258f3f93857bc4f1b203405964be7) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-13drm/panel: novatek-nt37801: Use mipi_dsi_*_multi() functionsNicolás Antinori
Replace mipi_dsi_* functions with their non-deprecated mipi_dsi_*_multi counterparts. This change reduces error-checking boilerplate and improves readability. Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260706224414.1015766-1-nico.antinori.7@gmail.com
2026-07-13drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue ↵Ryosuke Yasuoka
worker A probe-time deadlock can occur between the dequeue worker and drm_client_register(). During probe, drm_client_register() holds clientlist_mutex and calls the fbdev hotplug callback, which triggers an atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs() waiting for virtqueue space. The dequeue worker that would free that space calls virtio_gpu_cmd_get_display_info_cb(), which invokes drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting to acquire the same clientlist_mutex. Since wake_up() is only called after the resp_cb loop, the probe thread is never woken and both threads deadlock. Fix this by removing the hotplug notification from virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info) is still updated synchronously in the callback. For the init path, drm_client_register() already fires an initial hotplug when the client is registered, which picks up the connector state updated by display_info_cb. For the runtime config_changed path, add a wait_event_timeout() in config_changed_work_func() so that display_info_cb updates the connector data before the hotplug notification is sent. Also replace drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since virtio-gpu never calls drm_kms_helper_poll_init() and thus drm_helper_hpd_irq_event() always returns false without doing anything. Fixes: 27655b9bb9f0 ("drm/client: Send hotplug event after registering a client") Closes: https://syzkaller.appspot.com/bug?id=d6dd6f86d3aaf7eebe7406e45c1c6e549453f224 Closes: https://syzkaller.appspot.com/bug?id=908bd910da5dd79b88de4cf7baf376cc873a922e Suggested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patch.msgid.link/20260713-virtiogpu_syzbot-v2-1-2958fa37d46d@redhat.com
2026-07-13drm/virtio: Don't detach GEM from a non-created contextJason Macnak
Applies the same treatment as commit 7cf6dd467e87 ("drm/virtio: Don't attach GEM to a non-created context in gem_object_open()") to virtio_gpu_gem_object_close() to avoid trying to detach a resource that was never attached due to a context never being created when context_init is supported. Fixes: 086b9f27f0ab ("drm/virtio: Don't create a context with default param if context_init is supported") Cc: <stable@vger.kernel.org> # v6.14+ Signed-off-by: Jason Macnak <natsu@google.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patch.msgid.link/20260625170828.3335431-1-natsu@google.com
2026-07-13drm/msm: Switch to generic PAS TZ APIsSumit Garg
Switch drm/msm client drivers over to generic PAS TZ APIs. Generic PAS TZ service allows to support multiple TZ implementation backends like QTEE based SCM PAS service, OP-TEE based PAS service and any further future TZ backend service. Acked-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260702115835.167602-9-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-12nouveau/instmem: use iomapping interface for instmem handlingDave Airlie
This avoids constant need to ioremap when instobjs move at least on 64-bit systems. This create the io mapping on first use, because creating it at init time causes a resource mapping error, because nouveau hasn't kicked simpledrm off the hardware yet, but ioremap_wc the whole BAR causes an overlap with BOOTFB/simpledrm. I think the resource system could do better here, but it's easier to just delay creating the mapping until first use. Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260706030520.857104-1-airlied@gmail.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12drm: nova: Use drm::Device<Registered> to access the parent bus deviceDanilo Krummrich
The get_param ioctl needs access to the parent auxiliary device. Since ioctl handlers run inside a RegistrationGuard, accept &NovaDevice<Registered> to obtain &auxiliary::Device<Bound> via as_ref() directly. This removes the need for drm::Device data, hence set it to (). Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-20-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12rust: drm: Pass registration data to ioctl handlersDanilo Krummrich
Pass registration data to ioctl handlers via drm::Device<Registered>::registration_data_with(). The closure's HRTB ties the lifetime to the closure scope, and the pointer cast shortens it from 'static internally. The reference is valid for the duration of the drm_dev_enter/exit critical section held by RegistrationGuard. Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-19-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12rust: drm: Add RegistrationData to drm::DriverDanilo Krummrich
Add a RegistrationData GAT (Generic Associated Type) to drm::Driver. The lifetime parameter is tied to the parent bus device binding scope. Registration<'a, T> takes ownership of the data via Pin<KBox<_>>, storing it with its real lifetime. The pointer is written to drm::Device before drm_dev_register() to ensure it is already in place when ioctls arrive. Device<T, Registered>::registration_data_with() provides access with the lifetime shortened from 'static via a pointer cast. Since Registration::drop() calls drm_dev_unplug(), which performs an SRCU barrier waiting for all drm_dev_enter() critical sections to complete, the data is guaranteed to remain valid for the duration of any RegistrationGuard. Reviewed-by: Lyude Paul <lyude@redhat.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-18-dakr@kernel.org [ Move registration_data_unchecked() to Device<T, Registered> impl block. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12drm: fix race between partial drm_dev_register() failure and ioctlDanilo Krummrich
If drm_dev_register() fails after registering a minor (e.g. render minor registered, primary minor fails), userspace could have opened the first minor and entered a drm_dev_enter() critical section. Since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources. Fix this by introducing drm_dev_synchronize_unplug(), which sets the unplugged flag and waits for the SRCU barrier, ensuring all in-flight drm_dev_enter() critical sections complete before cleanup proceeds; call it on the error path of drm_dev_register(). Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged") Cc: stable@vger.kernel.org Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260620190648.2E9F61F000E9@smtp.kernel.org/ Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-17-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12rust: drm: Wrap ioctl dispatch in RegistrationGuardDanilo Krummrich
Make Ioctl handlers receive a &Device<T, Registered> reference, proving at the type level that the device is registered and its parent bus device is bound. This is achieved by calling registration_guard() on the Device<T, Ioctl> obtained in ioctl dispatch context. If the device has been unplugged, the ioctl returns -ENODEV without calling the handler. To resolve the driver type parameter T for type inference, which the compiler cannot propagate through method resolution and associated-type projections alone, a dead-code closure and a helper function are used as a type-inference anchor. Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-14-dakr@kernel.org [ Use imperative mood in commit message; clarify __dev_ctx_cast() doc comment to reflect Ioctl-to-Registered cast. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12rust: drm: restrict AlwaysRefCounted to Normal GEM Object contextDanilo Krummrich
Restrict AlwaysRefCounted for gem::Object and gem::shmem::Object to the Normal context, since only Normal objects should be independently reference-counted. To avoid cascading through IntoGEMObject (which had AlwaysRefCounted as a supertrait), remove AlwaysRefCounted from IntoGEMObject's supertraits and instead add it as an explicit bound on lookup_handle(), which is the only BaseObject method that returns an ARef. Since Object::new() and shmem::Object::new() return ARef<Self>, move them to Normal-only impl blocks. Similarly, simplify ObjectConfig and shmem's parent_resv_obj field to the Normal context. Remove the DeviceContext generic from DriverObject::new() and Driver::Object, since GEM objects can only be constructed in the Normal context. Simplify DriverAllocImpl accordingly. Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-8-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12rust: drm: change default DeviceContext to NormalDanilo Krummrich
Change the default DeviceContext from Registered to Normal for drm::Device, gem::Object, gem::shmem::Object and gem::shmem::ObjectConfig. Normal is the general-purpose, reference-counted context suitable for most uses; Registered represents a device that was registered with userspace and will become a non-owning context obtained through a RegistrationGuard. Update the create_handle/lookup_handle bounds from Object<Registered> to Object<Normal> to match the new default context of GEM objects, and update the driver device type aliases (NovaDevice, TyrDrmDevice) to default to Normal. Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-6-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12rust: drm: Add Driver::ParentDevice associated typeDanilo Krummrich
Add a ParentDevice associated type to the Driver trait, allowing each DRM driver to declare its parent bus device type (e.g. auxiliary::Device, platform::Device). Change UnregisteredDevice::new() to take &T::ParentDevice<Bound>, ensuring at the type level that the DRM device's parent matches the declared bus device type. Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-5-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12Revert "drm/msm: dsi: fix PLL init in bonded mode"Dmitry Baryshkov
Commit 93c97bc8d85d ("drm/msm: dsi: fix PLL init in bonded mode") fixed one of the issues with the DSI bonded mode, but broke non-bonded usecase for DSI as reported by Mohit Dsor. Clock divider is being programmed incorrectly, resultin in the wrong display mode being selected. Revert the offending commit, letting Neil to work on a better fix. Fixes: 93c97bc8d85d ("drm/msm: dsi: fix PLL init in bonded mode") Reported-by: Mohit Dsor <mohit.dsor@oss.qualcomm.com> Closes: https://lore.kernel.org/r/ae07cef84AmXK43H@hu-mdsor-hyd.qualcomm.com Cc: Neil Armstrong <neil.armstrong@linaro.org> Cc: Thorsten Leemhuis <regressions@leemhuis.info> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/739459/ Link: https://lore.kernel.org/r/20260712-msm-revert-dsi-pll-fix-v1-1-40122689ea25@oss.qualcomm.com
2026-07-12drm/msm/dpu: fix parameter name in dpu_core_perf_adjusted_mode_clk kernel-docRosen Penev
The kernel-doc referred to @crtc_clk_rate but the actual parameter is @mode_clk_rate. Assisted-by: Opencode:Big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Fixes: 62b7d6835288 ("drm/msm/dpu: Filter modes based on adjusted mode clock") Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/729413/ Link: https://lore.kernel.org/r/20260530201342.10538-1-rosenp@gmail.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-12drm/msm/dsi: round 6G byte clock rate to the PLL-achievable valueKavan Smith
MSM8916 runtime DSI commands still go through msm_dsi_host_xfer_prepare(), which re-applies the link clock rate before enabling the link clocks. That is fine in principle, but on DSI 6G the requested byte clock rate often does not exactly match the DSI PHY PLL's realizable rate. For example, the driver can request 56250000 Hz while the PLL actually runs at 56246337 Hz. Because the requested and actual rates differ slightly, every later link_clk_set_rate() call is treated as a real clock change and re-locks the PLL. On a video-mode panel without an internal timing generator, such as samsung,s6d7aa0 / lsl080al03 on MSM8916, that live-clock glitch makes the panel lose pixel lock and visibly corrupts scanout on each runtime DCS command, including backlight writes. Fix this by rounding the computed 6G byte clock rate up front, before it is stored in msm_host->byte_clk_rate and reused by later transfers. Once the host carries the PLL-achievable rate instead of the idealized one, repeated link_clk_set_rate() calls become no-ops in the common clock framework and no longer re-lock the PLL. This keeps the normal transfer callback sequencing intact, preserves the OPP vote path in link_clk_set_rate(), and matches the fix direction suggested in the original 2018 discussion. Reported-by: Daniel Mack <daniel@zonque.org> Closes: https://lore.kernel.org/all/1a682c5b-7fc9-3aaa-120b-64b239a355a3@zonque.org/ Fixes: 6b16f05aa39f ("drm/msm/dsi: Split clk rate setting and enable") Cc: stable@vger.kernel.org Signed-off-by: Kavan Smith <kavansmith82@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/738234/ Link: https://lore.kernel.org/r/20260707013240.681012-1-kavansmith82@gmail.com [DB: dropped extra chunk from the patch] Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-12drm/msm/dp: add missing drm_edid_connector_update() before add_modes on ↵Jens Glathe
cached EDID After the refactor to struct drm_edid, the fast path in msm_dp_panel_get_modes() that already held a cached EDID called drm_edid_connector_add_modes() directly without first calling drm_edid_connector_update(). The new API requires the update step to associate the EDID with the connector. Add the missing call. This restores correct behaviour for the cached-EDID path. Fixes: 5bea90ad9743 ("drm/msm/dp: switch to struct drm_edid") Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz> Patchwork: https://patchwork.freedesktop.org/patch/731125/ Link: https://lore.kernel.org/r/20260608-drm_plug_flaky_edid-v3-1-1ca632938e7f@oldschoolsolutions.biz Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-11rust: types: rename ForLt to CovariantForLtDanilo Krummrich
Rename ForLt to CovariantForLt to prepare for the introduction of a new ForLt base trait that does not require covariance. The existing ForLt trait requires covariance, which enables the safe cast_ref() method. This rename preserves the same semantics under a more precise name, making room for a weaker ForLt trait in a subsequent commit. No functional change. Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Miguel Ojeda <ojeda@kernel.org> Link: https://patch.msgid.link/20260626183630.2585057-2-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-11gpu: nova-core: use I/O projection for cleaner encapsulationGary Guo
Use `io_project!` for PTE array and message queues to restore the proper encapsulation. The remaining `dma_read!` and `dma_write!` is now only acting on primitives; thus replace by `io_read!` and `io_write!`. Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260706-io_projection-v6-17-72cd5d055d54@garyguo.net Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-11drm/xe/pf: Handle migration descriptor using KLV helpersMichal Wajdeczko
As we plan to add more KLVs to the migration descriptor packet, to simplify such extensions and avoid coding errors, start using our KLV helpers for packet preparing and parsing. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-14-michal.wajdeczko@intel.com
2026-07-11drm/xe/tests: Add migration packet testMichal Wajdeczko
One of our migration data packet (descriptor) is based on the KLV encoding. Add a simple descriptor initialization test, as we plan to use new KLV helper functions there. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260708180921.2715-1-michal.wajdeczko@intel.com
2026-07-11drm/xe/tests: Add GuC KLV printer testMichal Wajdeczko
For completeness, add a simple test to exercise the KLV printer to make sure it doesn't crash at least. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260711073608.7829-1-michal.wajdeczko@intel.com
2026-07-11drm/xe/tests: Add object encoding helper testMichal Wajdeczko
We will soon be encoding complex objects as KLVs using our helper function. Add few simple tests to make sure this helper function works as expected. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260710195945.7316-1-michal.wajdeczko@intel.com
2026-07-11drm/xe/tests: Add string encoding helper testMichal Wajdeczko
Before we start using string to KLV encoding helper, add a simple test to make sure it works as expected. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> #v1 Link: https://patch.msgid.link/20260708180755.2684-1-michal.wajdeczko@intel.com
2026-07-11drm/xe/tests: Add GuC KLV helpers basic testsMichal Wajdeczko
We will be making more extensive use of GuC KLV helpers. Add simple tests to ensure the helpers are working as expected. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-9-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Formalize Reserved KLVsMichal Wajdeczko
We have already started using few KLV keys from the 0xF000 range that, as we have agreed with the GuC team, will not be used in any GuC ABI actions. Add definitions for that reserved range and move our migration KLVs to new ABI header. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260710172534.7201-1-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Add KLV parsing helperMichal Wajdeczko
We have already introduced a helper to encode larger objects. Now add helper to parse the KLVs buffer. We will use it shortly. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-7-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Add object KLV encoding helperMichal Wajdeczko
We plan to encode larger objects as single KLV or set of KLVs. Add helper for that. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-6-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Add string KLV encoding helperMichal Wajdeczko
We also plan to encode a text data as KLV. Add helper for that too. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-5-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Add basic KLV encoding helpersMichal Wajdeczko
We plan to encode more data as KLVs. Add helpers for that. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-4-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Prepare to print group KLVsMichal Wajdeczko
Some future KLVs will be encoded as a group of nested KLVs. Prepare our KLV printer function to handle such KLVs. List of known group keys will be updated later, for now just prepare it for testing. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-3-michal.wajdeczko@intel.com
2026-07-11drm/xe/guc: Allow to print single KLVMichal Wajdeczko
We can decode and print all KLVs from the buffer, but it might be helpful also to allow printing just single already decoded KLV. Extract existing code into new function and make it public. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260707220816.677-2-michal.wajdeczko@intel.com
2026-07-10drm/panfrost: include panfrost_drv.h for panfrost_transparent_hugepageBen Dooks
The panfrost_transparent_hugepage variable is declared in panfrost_drv.h but the panfrost_drv.c does not incldue this header. Fix the following sparse warning by including panfrost_drv.h : drivers/gpu/drm/panfrost/panfrost_drv.c:958:6: warning: symbol 'panfrost_transparent_hugepage' was not declared. Should it be static? Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Adrián Larumbe <adrian.larumbe@collabora.com> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20260623104617.768289-1-ben.dooks@codethink.co.uk Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
2026-07-10drm/panel: samsung-s6d16d0: Power off on prepare failureLaxman Acharya Padhya
If enabling tearing mode or exiting sleep mode fails after the regulator is enabled, s6d16d0_prepare() returns without asserting reset or disabling the supply. Since the DRM panel core leaves the panel unprepared, a later unprepare call skips the driver callback and the supply remains enabled. Assert reset and disable the supply before returning the DSI command error. Fixes: ac1d6d74884e ("drm/panel: Add driver for Samsung S6D16D0 panel") Assisted-by: Codex:gpt-5 Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260704070648.35249-1-acharyalaxman8848@gmail.com
2026-07-10drm/xe: Use xe_tile_info() in alloc_primary_gt() and alloc_media_gt()Shuicheng Lin
alloc_primary_gt() and alloc_media_gt() both operate in the context of a specific tile, and the configfs-disabled messages describe a per-tile primary/media GT. Switch from xe_info(xe, ...) to xe_tile_info(tile, ...) so the log lines are prefixed with "Tile%u:", which disambiguates the message on multi-tile devices. Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260708221233.3251663-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-07-10drm/xe/configfs: Add enable_multi_queue attributeShuicheng Lin
Add a new configfs boolean attribute 'enable_multi_queue' that lets an administrator force-disable multi-queue support on a device before it binds to the driver. The attribute defaults to true (use the platform hardware capability as-is); writing 0 force-disables multi-queue. This is intended for debugging and for validating non-multi-queue code paths on hardware that would otherwise expose multi-queue. The override disables multi-queue at two levels: - UAPI: In alloc_primary_gt(), clear gt->info.multi_queue_engine_class_mask on the primary GT so that xe_gt_supports_multi_queue() returns false and attempts to create a multi-queue group via DRM_XE_EXEC_QUEUE_SET_PROPERTY_MULTI_GROUP are rejected. - GuC: In guc_ctl_feature_flags(), set the GUC_CTL_DISABLE_MULTI_QUEUE (BIT(24)) init-params bit on GuC firmware older than 70.66. On GuC firmware 70.66 and above, guc_waklv_init() emits the new GUC_FEATURE_KLV_DISABLE_MULTI_QUEUE Feature KLV (0x5001) via the ADS WA/Feature KLV buffer instead. Feature KLVs share the WA KLV buffer. The attribute is rejected after the device has been bound, so it only takes effect during probe: # echo 0 > /sys/kernel/config/xe/0000:03:00.0/enable_multi_queue # echo 0000:03:00.0 > /sys/bus/pci/drivers/xe/bind v2: Add log for multi-queue disabled. (Niranjana) v3: Rename attribute to enable_multi_queue with default true. (Stuart && Niranjana) v4: rebase. Assisted-by: Claude:claude-opus-4.7 Cc: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260709200822.3257825-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-07-10drm/xe/i2c: use platform_device_set_fwnode()Bartosz Golaszewski
Ahead of reworking the reference counting logic for platform devices, encapsulate the assignment of the firmware node for dynamically allocated platform devices with the provided helper. Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260706-pdev-fwnode-ref-v3-15-1ff028e33779@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-10drm/qxl: remove dependency on DRM simple helpersDiogo Silva
Simple KMS helper are deprecated since they only add an intermediate layer between drivers and the atomic modesetting. This patch removes the drm_simple_encoder_init() helper usage in the qxl display driver by open coding it and using the encoder atomic helpers directly. This is a step to eventually get rid of this simple KMS helper, once all drivers that use it have been converted. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260707-qxl-simple-v2-1-08d21bc74a41@gmail.com
2026-07-10Merge tag 'tegra-for-7.2-pmc-fixes' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes soc/tegra: pmc: Fixes for v7.2 This contains two fixes, one for a bad error unwinding path and another for an #ifdef block that wasn't covering all the combinations correctly. * tag 'tegra-for-7.2-pmc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: fix #ifdef block in header drm/tegra: Fix a strange error handling path Signed-off-by: Arnd Bergmann <arnd@arndb.de>